Host security and auditing: AIDE, auditd
auditd, integrity checking and behaviour monitoring.
Level 301 · 16 lessons · 18 practice labs
Lessons
File integrity
- File integrity monitoring with AIDE: You will understand how file integrity monitoring with auditd reveals unauthorised changes to important files, and which files deserve watching.
- AIDE: baseline and report: You will learn to record a healthy system's baseline with AIDE, used alongside auditd, and later read the report to see what has changed.
- Tuning AIDE rules: excluding noisy directories
- Scheduling AIDE checks and sending the report
- Short task: find a modified system file with AIDE
auditd
- System auditing with auditd: You will understand how auditd records who did what on a system and where those records are kept.
- auditd audit rules and keys: You will learn to use auditd rules that choose which events get recorded, and keys that make those records easy to find later.
- Watching sensitive files: /etc/shadow, sudoers, SSH keys
- Recording executed commands: execve rules
- auditd: correlating events with ausearch: You will learn to use ausearch, part of auditd, to pull scattered audit records together and tell the full story of a single event.
- Summary reports with aureport
- Short task: write a rule that catches crontab changes
Investigation
- Filtering failed logins with grep and auditd: You will learn to filter failed login attempts out of auditd and system logs and spot repeating accounts and source addresses.
- Extracting sudo activity with auditd: You will learn to extract from auditd records who ran which commands with administrator rights via sudo, and to notice unusual use.
- Investigating insider access and file tampering with auditd and AIDE: In a fictional case, you will learn to reconstruct step by step an employee's privileged access and unauthorised file changes from auditd audit records.
- Capstone: an audit report for a server with auditd and AIDE: Capstone: on a fictional company's server, you review file integrity and auditd audit records and gather your findings into a short audit report.
Practice labs
- Find a modified system file with AIDE: Run a check against the existing baseline and identify the changed binary in the report.
- Exclude noisy folders from the AIDE rules: Remove log and cache paths that change on every run from the rules and show the report gets cleaner.
- Safely refresh the baseline after a legitimate update: Verify changes caused by a package update, set aside one suspicious file and build the new database.
- Catch a file with a rolled-back timestamp using AIDE: Find a file whose timestamp was set back but content changed using the hash difference and explain why ls hides it.
- Write a rule watching /etc/passwd changes: Add a watch rule with a key, change the file and find the event by its key with ausearch.
- Write a rule that catches SSH keys being added: Watch every user’s authorized_keys file and find the user who added a new key from the event.
- Record commands run as root with execve: Add an execve rule for euid=0, reduce the noise and list the commands an admin ran.
- Stop the rules from vanishing after a reboot: Move rules added only with auditctl to the persistent file, enable immutable mode and prove it after a reboot.
- Summarise failed logins with aureport: Produce the failed authentication report and note the most targeted account and source.
- Extract everything a user did with sudo: Use the auid field to tie the commands run after sudo to the user and put them in time order.
- Find the deleted log and who deleted it: Use events containing unlink calls to identify the deleted log file and the user who deleted it, with the time.
- Prove an insider copied data using two sources: Combine auditd access records with the AIDE change report and show who copied the files and where.
- Find on whose behalf a night-time script runs: Filter the events at 02:00 and list the user of the script launched from cron and the files it touched.
- Read an AIDE report and explain the kinds of change: Separate added, removed and changed entries in the report and note which attribute each change affects.
- Prove the AIDE database itself has not been tampered with: Move the database and configuration to a read-only location, store its hash separately and show the check catches a change made to the copy left in place.
- Explain the difference between auid and uid in an audit record: In three given auditd records find the original user from the auid field and name the person who became root through sudo.
- Read the command and arguments in an execve record: Extract the program run, its arguments and working directory from three records in ausearch output.
- Strip the noise from command logging and turn it into a daily report: Exclude monitoring-agent and cron records by rule and produce an aureport-based report summarising the remaining root commands per user.
About this course
auditd, integrity checking and behaviour monitoring.
What you will learn
- File integrity
- auditd
- Investigation
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.